Screenshotline

A screenshot API that survives production. URL in, image out.

curl "https://api.screenshotline.com/take?url=https://example.com&block_cookie_banners=true" -o shot.png

Above: france24.com, captured by this API. The consent wall is gone, the empty ad slot has been collapsed rather than left as a grey hole pushing content below the fold, and the lazy-loaded hero image has actually loaded. Most screenshot failures are not crashes — they are a 200 with the wrong picture.

Two ways to use it

Hosted — screenshotline.com. Free tier, 500 renders a month, no card. Warm browser pool, cache, and someone else's pager.

Self-hosted — docker compose up -d. The same renderer, nothing held back. See SELF-HOSTING.md, which is honest about what running headless Chrome at scale actually costs you.

Why this exists

Taking one screenshot with Puppeteer is twenty lines. Taking ten thousand is a different job, and it is the job people pay to avoid:

Plus the one that is not a performance problem: an endpoint that fetches arbitrary URLs is an SSRF engine by default. Private and reserved ranges are refused, and every redirect hop is re-checked, not just the submitted URL.

Quick start

Docker (recommended)

docker compose up -d
curl "http://localhost:3000/take?url=https://example.com" -o out.png

Node 22+

npm install
npm start          # http://localhost:3000
npm run smoke      # 30 checks against the real render path

Open http://localhost:3000 for a demo with no signup.

API

One endpoint. GET or POST /take, returning binary image data — no JSON envelope, no second round trip. That is deliberate: the URL has to work directly inside an <img src>.

GET /take
  ?url=https%3A%2F%2Fexample.com
  &format=webp
  &full_page=true
  &block_cookie_banners=true
  &viewport_width=1440
  &cache=true&cache_ttl=86400

Parameters

Response headers

Errors

JSON, with a message that says how to fix it.

{
  "error": {
    "code": "render_timeout",
    "message": "Render exceeded 30000ms. Heavy ad and tracking scripts are the usual cause - try block_ads=true, or a longer timeout (up to 60000)."
  }
}

The silent failure this API tries hard to avoid

A blank white image returned with HTTP 200 is worse than an error: the customer's pipeline records a success and nobody notices for a month. Bot walls, blocked challenge scripts and pages that render nothing without JavaScript all produce exactly that.

Every response therefore carries X-Blank-Suspected, decided from two independent signals - an empty DOM, and encoded bytes-per-pixel far below what a real screenshot produces. Pass fail_on_blank=true to turn it into a 502 instead, and fail_on_http_error=true if an upstream 403 should be your problem rather than a picture of a bot wall.

Measured on the 202-page suite: 7 pages returned a technically successful but visually empty capture before this existed.

Reading a page instead of photographing it

GET or POST /extract runs the exact same render — JavaScript executed, the adaptive settle, consent banners swept, ad slots collapsed, lazy images loaded — and then reads the DOM as Markdown instead of photographing it.

GET /extract?url=https%3A%2F%2Fexample.com

# Example Domain

This domain is for use in documentation examples without needing permission.

[Learn more](https://iana.org/domains/example)

Everything from /take still applies — block_ads, basic_auth, headers, settle, timeout, signed URLs, the SSRF guards.

Why this is not just curl | html2md: by the time we extract, we are holding a fully rendered, consent-swept DOM. Two things follow from that which a server-side HTML parser cannot do.

• Client-rendered pages work. A plain fetch of app.netlify.com yields 121 characters of visible text, and they read "The Netlify dashboard needs JavaScript :(". Rendered first, the same URL extracts the actual login page.
• Layout disambiguates the text. danluu.com writes <d>09/26</d><a ...>title</a> with no whitespace between them and styles <d> as a 4em flex item. Parsed as markup that concatenates to 09/26[title]; read with the computed layout it becomes 09/26 [title].

Open shadow roots are walked too, so pages built out of web components extract as text rather than as nothing. Closed roots are unreachable by design.

MCP server

Agents get both halves of this over the Model Context Protocol: the screenshot for when the layout is the answer, the Markdown for when the text is.

Hosted, nothing to install — connect by URL with a free key (500 renders a month, no card):

claude mcp add --transport http screenshotline https://api.screenshotline.com/mcp --header "X-Access-Key: sl_live_..."

Self-hosting, it runs locally over stdio from a clone, owning a single browser:

claude mcp add screenshotline -- node /path/to/screenshotline/mcp/server.js

Two tools:

Point either one at an instance you already run — with its warm pool, cache and rate limit — by setting SCREENSHOTLINE_BASE_URL, plus SCREENSHOTLINE_ACCESS_KEY if that instance requires a key.

The SSRF guards apply here too. An agent cannot talk this server into scanning 127.0.0.1 or a cloud metadata endpoint.